Back to Courses
CW-PEN-200 Intermediate

Advanced PEN Testing using Kali Linux

CyberWhale Security

60 Hours
Live Interactive Online Sessions
Enroll Now
Advanced PEN Testing using Kali Linux

Course Overview

Take your technical skills to the next level with this 60-hour, beginner-to-intermediate course delivered through live, interactive online sessions. Designed for graduates, career switchers, and cybersecurity professionals, this program teaches you how to master Red Team offensive technologies and Kali Linux. You will also gain cutting-edge experience by exploring the latest AI-based attacks and dedicated practical labs.

Key Features

  • Beginner to Intermediate: Moves smoothly from core fundamentals to advanced offensive concepts.
  • Red Team Focus: Practical experience with real-world attack methodologies and exploit tools.
  • AI-Powered Threat Labs: Hands-on practice executing and defending against AI-driven cyber threats.

What You'll Learn

  • Advanced Exploitation: Vulnerability analysis, network scanning, and system hacking using Kali Linux.
  • AI-Based Cyber Attacks: Hands-on labs covering prompt injection, automated phishing, and AI threat evasion.
  • Red Team Tactics: Post-exploitation, privilege escalation, and bypassing defensive security controls.

Who Is This For

  • Graduates & Career Switchers looking to enter the offensive security field with a future-proof skillset.
  • Cybersecurity Professionals wanting to transition into Red Teaming and master modern AI threat landscapes.
Course Blueprint

Module-by-Module Syllabus

01

Introduction to Penetration Testing with Kali Linux

4 Hours
Learning Objective

Learners can stand up an isolated, legally-scoped pentest lab and map an engagement to a recognised methodology.

Topics Covered

  • • Kali Linux installation, virtualization and tool-set configuration
  • • Penetration testing methodologies (PTES, OSSTMM, OWASP)
  • • Legal and ethical frameworks, scope and rules of engagement
  • • Building and preparing a personal lab environment
  • • The practice of cybersecurity: red team vs blue team vs purple team
  • • Threats and threat actors: motivations, capability tiers, kill chain

Lab Tools & Technologies

  • › Kali Linux
  • › VMware/VirtualBox
  • › Proxmox
  • › Git
  • › tmux
  • › MITRE ATT&CK Navigator

Hands-on Lab Deliverable

Build a fully configured Kali Linux attack VM and a vulnerable target lab (Metasploitable2, DVWA) on an isolated virtual network.

02

Information Gathering

6 Hours
Learning Objective

Learners can produce a structured reconnaissance report identifying live hosts, open services and exposed information.

Topics Covered

  • • Passive and active reconnaissance techniques
  • • Open-Source Intelligence (OSINT) collection and correlation
  • • Network enumeration with Nmap and Shodan
  • • Service discovery, banner grabbing and fingerprinting
  • • DNS, WHOIS and subdomain enumeration

Lab Tools & Technologies

  • › Nmap
  • › Shodan
  • › theHarvester
  • › Recon-ng
  • › Maltego
  • › Amass
  • › Sublist3r
  • › Wireshark

Hands-on Lab Deliverable

Perform a full passive-to-active recon workflow against a lab target: OSINT profile build, subdomain enumeration, and an Nmap service/version scan with scripted output.

03

Vulnerability Scanning & Analysis

6 Hours
Learning Objective

Learners can conduct authenticated and unauthenticated vulnerability scans, triage results, and prioritise findings for exploitation.

Topics Covered

  • • Vulnerability scanning methodology and scan types
  • • Authenticated vs unauthenticated scanning
  • • Analysing and triaging scan results
  • • False-positive identification and validation
  • • CVE/CWE referencing and CVSS scoring

Lab Tools & Technologies

  • › Nessus
  • › OpenVAS
  • › Nikto
  • › Nmap NSE scripts
  • › Searchsploit / Exploit-DB

Hands-on Lab Deliverable

Run authenticated and unauthenticated vulnerability scans against lab targets, triage the results, eliminate false positives, and produce a prioritised findings list.

04

Web Application Security

8 Hours
Learning Objective

Learners can identify, exploit and document OWASP Top 10-class vulnerabilities in a web application.

Topics Covered

  • • Web application assessment methodology (OWASP Testing Guide)
  • • Web application assessment tooling and proxy-based testing
  • • Common web application attacks: OWASP Top 10 overview
  • • Cross-Site Scripting (XSS): reflected, stored, DOM-based
  • • Directory traversal and file inclusion vulnerabilities
  • • SQL Injection attacks: in-band, blind and out-of-band
  • • Client-side attacks: CSRF, clickjacking, DOM manipulation

Lab Tools & Technologies

  • › Burp Suite
  • › OWASP ZAP
  • › sqlmap
  • › DVWA
  • › Gobuster/ffuf
  • › XSStrike
  • › Postman

Hands-on Lab Deliverable

Assess DVWA/WebGoat end-to-end: intercept traffic in Burp Suite, exploit stored XSS, exploit a directory traversal flaw, and extract a database using sqlmap.

05

Active Directory Introduction and Enumeration

8 Hours
Learning Objective

Learners can enumerate a Windows domain, visualise attack paths and demonstrate an authentication-relay attack.

Topics Covered

  • • Active Directory architecture: forests, domains, trusts, GPOs
  • • Manual Active Directory enumeration techniques
  • • Understanding Active Directory authentication (NTLM, Kerberos)
  • • Performing attacks on Active Directory authentication
  • • Active Directory lateral movement techniques
  • • Active Directory persistence mechanisms

Lab Tools & Technologies

  • › BloodHound
  • › PowerView
  • › Impacket suite
  • › CrackMapExec/NetExec
  • › Responder
  • › Rubeus
  • › Mimikatz

Hands-on Lab Deliverable

Enumerate a Windows AD lab domain with BloodHound and PowerView, capture and relay NTLM hashes with Responder, and map an attack path to Domain Admin.

06

Advanced Exploitation Techniques

8 Hours
Learning Objective

Learners can locate, adapt and deliver public exploits against lab targets, and execute password attacks with appropriate tooling.

Topics Covered

  • • Locating public exploits and matching them to targets
  • • Fixing and customizing exploit code for lab conditions
  • • Antivirus and endpoint detection evasion concepts
  • • Password attacks: brute force, spraying, credential stuffing
  • • AI-powered attack techniques and adversarial tooling (NEW)

Lab Tools & Technologies

  • › Exploit-DB / searchsploit
  • › Metasploit
  • › msfvenom
  • › Hydra
  • › John the Ripper
  • › Hashcat
  • › Veil / Shellter (evasion concepts)

Hands-on Lab Deliverable

Locate a public exploit for a lab CVE, patch and compile it for the target environment, then run a controlled password-spraying attack with Hydra against a lab service.

07

Privilege Escalation

6 Hours
Learning Objective

Learners can systematically identify and exploit privilege-escalation vectors and pivot across network segments.

Topics Covered

  • • Windows privilege escalation vectors: services, tokens, registry, scheduled tasks
  • • Linux privilege escalation vectors: SUID/SGID, cron, kernel exploits, misconfigurations
  • • Advanced tunneling: pivoting through compromised hosts

Lab Tools & Technologies

  • › WinPEAS
  • › LinPEAS
  • › PowerUp
  • › GTFOBins
  • › Chisel
  • › ligolo-ng
  • › SSH/SOCKS pivoting

Hands-on Lab Deliverable

Escalate privileges on a hardened Windows and a hardened Linux target using automated enumeration scripts, then pivot through the compromised host to reach an internal-only network segment.

08

Post-Exploitation & Persistence

6 Hours
Learning Objective

Learners can maintain access, exfiltrate data and establish persistence on compromised hosts while evading detection.

Topics Covered

  • • Post-exploitation data harvesting and exfiltration
  • • Establishing persistence on Windows and Linux
  • • Covering tracks: log manipulation and timestomping
  • • Command and Control (C2) frameworks overview
  • • Advanced pivoting and multi-hop tunneling

Lab Tools & Technologies

  • › WinPEAS
  • › LinPEAS
  • › PowerUp
  • › GTFOBins
  • › Chisel
  • › ligolo-ng
  • › SSH/SOCKS pivoting

Hands-on Lab Deliverable

Establish persistence on a compromised host, set up a C2 callback, and pivot through the host to access an internal network segment.

09

Reporting and Documentation

6 Hours
Learning Objective

Learners can independently produce a client-ready penetration testing report end to end.

Topics Covered

  • • Report writing standards for penetration testers
  • • Structuring an executive summary vs a technical findings section
  • • Writing effective, evidence-backed technical penetration testing reports
  • • Risk rating, remediation guidance and client debrief practices

Lab Tools & Technologies

  • › Dradis
  • › Markdown/Word/PDF reporting templates
  • › PlexTrac
  • › Faraday
  • › CVSS Calculator

Hands-on Lab Deliverable

Compile findings from Modules 2-8 into a full professional penetration test report, including an executive summary, CVSS-rated findings and remediation roadmap.

Ready to Get Started?

Secure your spot in CW-PEN-200 and begin your journey into professional penetration testing.

Enroll Now